Mastering Windows Network Forensics and Investigation Chapter 8: The Registry Structure

June 3, 2015 © Wiley Inc All Rights Reserved 2 Chapter Topics: Registry History Registry Structure & Terms Registry Research Viewing Registry with Forensic Tools

Registry History Massive database of system and program configuration settings Legacy Windows (Windows 3.0) had config.sys, autoexe.bat, and several “ini” files Text files lacked hierarchical structure and couldn’t easily store binary data June 3, 2015

Registry History Windows 3.1 had first rudiments of registry Windows 95 / NT expanded it more along the lines of what we see today. Each subsequent release has resulted in increase in size and complexity of registry June 3, 2015

Registry Structure & Terminology At physical level, registry stored in hive files User rarely interfaces directly with registry Regedit is current interface tool (regedt32 legacy) – no known shortcut - Run > regedit June 3, 2015

Regedit Interface June 3, 2015 Key PaneValue Pane

Five Root Keys June 3, 2015

HKEY_CLASSES_ROOT Used to associate file types with programs that open them and also used to register classes for Component Object Model (COM) objects. It is the largest of the root keys in terms of the registry space it occupies. This key is derived from a linked merger of two keys, which are HKLM\Software\Classes and HKCU\Software\Classes. This merger effectively blends default settings with per user settings. June 3, 2015

HKEY_CURRENT_USER Used to configure the environment for the console user. It is a per-user setting (specific only to this user) and is a derived from a link to HKU\SID, where the SID is the user’s security identifier. June 3, 2015

HKEY_CURRENT_CONFIG Used to establish the current hardware configuration profile. This key is derived from a link to HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current. Current is derived from a link to HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\####, where #### is a number that increments starting at “0000”. HKLM\SYSTEM\CurrentControlSet, in turn, is a link to HKLM\SYSTEM\ControlSet###, where ### is a number that increments starting at 000. The value located in HKLM\SYSTEM\Select\Current determines which control set is current and therefore which ControlSet is to be used to create this key via a link. June 3, 2015

HKEY_LOCAL_MACHINE Used to establish the per-computer settings. Settings found in this key apply to the machine and all of its users, covering all facets of the computer’s function. This key is a master key and is not, therefore, derived from any link as are the previous three keys. During system startup, the local machine settings are loaded before the user specific settings. June 3, 2015

HKEY_USERS Used to contain the user environment settings for the console user as well as other users who have logged onto the system. There will be at least three subkeys, which are “.DEFAULT,” “SID,” and “SID_Classes,” where the “SID” is that of the console user. You may also find SID’s “S ,” “S ,” and “S ,” which are for the “LocalSystem,” “LocalService,” and “NetworkService” accounts, respectively. Any other SID’s found here will below to other users who have logged on to the machine. This key is a master key and is not, therefore, derived from any link as are the first three keys (the ones that are unbolded). June 3, 2015

Derived vs Master Only HKEY_LOCAL_MACHINE (HKLM) & HKEY_USERS (HKU) are Master Keys The remaining root keys are derived from other keys At a physical level, each of the logical master keys has its source data in files called hives June 3, 2015

HKLM Subkeys June 3, 2015 Hardware is dynamic and exist only on a live machine!

HKLM Keys > Hive Files June 3, 2015 H IVE K EY H IVE F ILE HKLM\SAM%SYSTEMROOT%\System32\config\SAM HKLM\SECURITY%SYSTEMROOT%\System32\config\SECURITY HKLM\SOFTWARE%SYSTEMROOT%\System32\config\software HKLM\SYSTEM%SYSTEMROOT%\System32\config\system

The Evidence Vault June 3, 2015

HKU Keys > Hive Files June 3, 2015 H IVE K EY H IVE F ILE HKU\.DEFAULT%SYSTEMROOT%\System32\config\default HKU\S Documents and Settings\LocalService ntuser.dat HKU\S _ClassesDocuments and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat HKU\S Documents and Settings\NetworkService ntuser.dat HKU\S _ClassesDocuments and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat HKU\SIDDocuments and Settings\UserName\ntuser.dat HKU\SID_ClassesDocuments and Settings\UserName\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

HKLM\SYSTEM\CurrentControlSet\Control\hivelist June 3, 2015

Determining Current Control Set June 3, 2015

Registry Value Data Types June 3, 2015 D ATA T YPE N UMBER D ESCRIPTION REG_NONE0Data type is not defined REG_SZ1Fixed length text string expressed in user-friendly format, which is often used to describe components REG_EXPAND_SZ2Variable or expandable length data string REG_BINARY3Binary data that is displayed in editor as hex REG_DWORD432-bit double word values and the most common data type found in the registry REG_DWORD_LITTLE_ENDIAN432-bit double word values with bytes in reverse order. As Intel already store data in this format, this term is synonymous with REG_DWORD and they have the same numeric value REG_DWORD_BIG_ENDIAN532-bit double word value with bytes in normal order with the highest bit appearing first REG_LINK6An internal-use only data type for Unicode symbolic link REG_MULTI_SZ7Multiple string field in which each string is separated by a null (00h) and with two nulls (00 00) marking the end of the list of strings REG_RESOURCE_LIST8Listing of resource lists for devices or device drivers (REG_FULL_RESOURCE_DESCRIPTOR). You can view, but not edit these lists.

Search in Regedit June 3, 2015

Registry Analysis Tools Regmon (Microsoft) User Assist Analyzer ( om/) om/ Access Data’s Registry Viewer Access Data’s Imager EnCase (View File Structure) June 3, 2015

Viewing Registry with Forensic Tools Forensic Tools –Access Data – Registry Viewer –EnCase – View File Structure –ProDiscover –Others Off-line registry differs from live registry Mount / Open Hive Files Don’t expect to see derived or dynamic keys June 3, 2015 © Wiley Inc All Rights Reserved 23